Skip to content

Unify lint CI job #7505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 19 commits into from
Mar 26, 2026
Merged

Unify lint CI job #7505

Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
0c9f3e5
use `prek` for unified linting
ShaharNaveh Mar 24, 2026
72fd632
Fix actionlint error
ShaharNaveh Mar 25, 2026
149cc38
Generate metadata when specific files change
ShaharNaveh Mar 25, 2026
e09cf9e
`check_redundant_patches.py` to accept glob path
ShaharNaveh Mar 25, 2026
15b06c2
Test
ShaharNaveh Mar 25, 2026
59a7d2c
revert defective changes
ShaharNaveh Mar 25, 2026
b39ab51
use `rustfmt` over `cargo fmt` for individual files
ShaharNaveh Mar 26, 2026
2f12793
Merge remote-tracking branch 'upstream/main' into ci-lint-unify
ShaharNaveh Mar 26, 2026
c7be0d6
debug reviewdog
ShaharNaveh Mar 26, 2026
4c3b303
rustfmt
ShaharNaveh Mar 26, 2026
3adf498
Move comment to correct location
ShaharNaveh Mar 26, 2026
855eca1
defevtive fmt test
ShaharNaveh Mar 26, 2026
15bdf1f
Fail with reviewdog
ShaharNaveh Mar 26, 2026
cefe51f
fix reviewdog perms
ShaharNaveh Mar 26, 2026
ae898da
Try to use present token
ShaharNaveh Mar 26, 2026
88028e6
without checks oerms
ShaharNaveh Mar 26, 2026
0d52e5e
put normal perms
ShaharNaveh Mar 26, 2026
eefe093
fmt
ShaharNaveh Mar 26, 2026
b2ba0c3
Merge remote-tracking branch 'upstream/main' into ci-lint-unify
ShaharNaveh Mar 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
put normal perms
  • Loading branch information
@ShaharNaveh
ShaharNaveh committed Mar 26, 2026
commit 0d52e5e0cc85670b8bf48ab8ba0e2a9a8273f53b
3 changes: 1 addition & 2 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,8 +333,7 @@ jobs:
runs-on: ubuntu-latest
permissions:
contents: read
# checks: write
# issues: write
checks: write
pull-requests: write
security-events: write # for zizmor
Comment on lines +332 to +338
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Restore the skip:ci guard on lint if that label is still meant to suppress the whole workflow.

Every other job in this workflow still short-circuits on skip:ci, but the unified lint job no longer does. Applying that label will therefore still run this path.

♻️ Suggested fix 
   lint:
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip:ci') }}
     name: Lint
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yaml around lines 332 - 338, The unified lint job
("name: Lint") is missing the skip:ci short-circuit used elsewhere; update the
Lint job to include the same conditional guard used by other jobs so the
workflow is skipped when the skip:ci label is present on a PR (i.e., add the
same "if" expression/guard that checks for the skip:ci label to the Lint job),
leaving the existing permissions block intact.

Comment on lines +334 to +338
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's find and examine the workflow file
find . -name "ci.yaml" -o -name "ci.yml" | head -20

Repository: RustPython/RustPython

Length of output: 92

🌐 Web query:

reviewdog/action-suggester permissions requirements documentation

💡 Result:

The reviewdog/action-suggester GitHub Action requires the following permissions in your workflow YAML: permissions: contents: read checks: write issues: write pull-requests: write These are specified in the official README to enable posting code suggestions via GitHub's multi-line suggestions feature on pull requests. See GitHub docs on Assigning permissions to jobs for details. The action supports pull_request events primarily.

Citations:

🏁 Script executed:

# Read the workflow file around the mentioned lines
fd "ci.yaml" --type f --exec wc -l {} \; 2>/dev/null | head -5

Repository: RustPython/RustPython

Length of output: 47

🏁 Script executed:

# Read the workflow file to check permissions and action usage
cat -n .github/workflows/ci.yaml | sed -n '320,400p'

Repository: RustPython/RustPython

Length of output: 3245

🏁 Script executed:

# Also check the workflow triggers at the top
cat -n .github/workflows/ci.yaml | head -20

Repository: RustPython/RustPython

Length of output: 915

Add missing issues: write permission and condition the reviewdog/action-suggester to pull requests only.

The action's documentation specifies it requires issues: write in addition to checks: write and pull-requests: write. Since the workflow runs on push, merge_group, and workflow_dispatch events, the current if: failure() condition can invoke the action outside pull request context where it cannot function. Add the required permission and limit execution to pull request events.

Suggested fix 
     permissions:
       contents: read
       checks: write
+      issues: write
       pull-requests: write
       security-events: write # for zizmor
       - name: reviewdog
-        if: failure()
+        if: failure() && github.event_name == 'pull_request'
         uses: reviewdog/action-suggester@aa38384ceb608d00f84b4690cacc83a5aba307ff # 1.24.0
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yaml around lines 334 - 338, Add the missing permission
and guard the reviewdog action to PRs only: under the workflow permissions block
add "issues: write" alongside the existing "checks: write" and "pull-requests:
write", and update the reviewdog/action-suggester step's if condition so it only
runs in a pull request context (e.g. change the current if: failure() to an
expression that also checks the event is a pull_request, like github.event_name
== 'pull_request' && failure()).

steps:
Expand Down